In the pressurized water reactors that I’m familiar with, the first fail-safe device is the control rods set into the reactor head. Those are held out of the reactor by solenoids, which consume relatively small amounts of electricity. In the event of a need to scram the reactor (to shut it down instantly), then the power to the solenoids is cut, and the boron control rods drop by gravity into the reactor to shut down the fission process. (This would happen automatically in case of a total system failure: loss of primary and backup power would cause the same scenario in a sort of dead-man trigger.)
The next fail safe is the Safety Injection Tanks, which is an arrangement of large tanks of water (possibly borated water, but I’m not sure) suspended inside the containment vessel and above the reactor pool. Though I’m not familiar with the piping and valving arrangement, my presumption is that these are valved so that in the event of a total system failure the valves would “fail open”. In other words, when control of the system is lost, the operators are dead or missing and the power is off (or other triggers occur), then the valves fail to remain closed (“fail open” is the term we use) and flood the containment with water to cool and cover everything that could be critical to the reaction process. Again, it’s a gravity-driven process that doesn’t depend on having power to do anything.
The reactor pool is set near the bottom of the containment vessel, and the reactor itself sits low in the flooded pool. If the primary level of containment has been breached, the 7” thick reactor vessel itself or the equally massive coolant piping from the steam generators or the steam generator “primary side” itself (a LOCA – Loss of Coolant Accident), and if the stainless steel lined concrete walled pool of water that it normally sits in has failed somehow, then the Safety Injection Tanks will flood the entire bottom of the containment vessel to cool everything and keep the fuel rods covered with boron and water. That’s key. The boron stops the fission process, and the water cools.
I don’t know yet what kind of screwup exposed the fuel rods to air, but that’s what lets the fissioning proceed, uncooled and potentially uncontrolled. It’s still not “a bomb”, but it’s not doing anything good.
That’s the reason that I don’t think that ice will be a major assist. The main problem seems to have been a failure to keep the rods covered with water. Everything after that is secondary. (On the other hand, spent fuel has been kept in “dry casks” in the US for a number of years without incident. I’m not familiar with how that process works; it’s not my area of expertise. I’ve seen that it does work, however, and left it at that.)
So in the cases we’re seeing now the earthquake and tsunami did not break containment, but something has happened to keep the entire process from working. Maybe – I’m just speculating here – the reactor was damaged and a LOCA did occur, but someone prevented the SIT flooding (assuming the boiling water reactor has SITs – I just don’t know). I can understand, maybe, why someone might try to be a hero and save the plant without doing that, because when you flood the containment with the SITs you’re going to have a major cleanup and economic loss in any case. SIT flooding means that you’ll irreparably damage a lot of other equipment in the containment in the attempt to save the entire plant.
My first guess here is that there’s going to have to be some kind of system that takes away a “decision” about whether or not to flood the containment. No one wants to make a decision to potentially lose a two billion dollar plant, so there has to be a way to make it a non-decision event, and one which cannot even be overridden by operators. But I’m just guessing here.